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A fundamental problem in intrusion detection is what metric(s) can be used to objectively 
evaluate an intrusion detection system (IDS) in terms of its ability to correctly classify 
events as normal or intrusive. Traditional metrics (e.g., true positive ... 
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In Intrusion Detection Systems (IDSs) for Mobile Ad hoc NETworks (MANETs), IDS agents 
using local detection engines alone may lead to undesirable performance due to the 
dynamic feature of MANETs. In this paper, we present a nonoverlapping Zone-based ... 
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Intrusion detection is a critical component of secure information systems. Network 
anomaly detection has been an active and difficult research topic in the field of Intrusion 
Detection for many years. However, it still has some problems unresolved. They ... 
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In order to improve the intrusion detection rates and reduce false positives, a hybrid 
BP/CNN neural network is constructed, which has both the capability of real-time 
classification which BP has and the functionality of time-delay, collection and judgment ... 
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Current IEEE 802.11 wireless networks are vulnerable to session hijacking attacks as the 
existing standards fail to address the lack of authentication of management frames and 
network card addresses, and rely on loosely coupled state machines. Even the ... 
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In 1987, Dorothy Denning published the seminal paper on anomaly detection as applied 
to intrusion detection on a single system. Her paper sparked a new paradigm in intrusion 
detection research with the notion that malicious behavior could be distinguished ... 
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A service-oriented approach to dynamic refinement of security enforcement is described 
in this paper. This is based on a closed loop feedback system where live distributed trust 
measures are used to adapt access control settings in a changing threat ... 
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In this paper, we present insights generated by modeling the emergence of insider threat 
vulnerabilities in organizations. In our model, we integrate concepts from social judgment 
theory, signal detection theory, and the cognitive psychology of memory ... 
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This paper proposes a statistical mechanism to analyze the detector coverage in a 
negative selection algorithm, namely a quantitative measurement of a detector set's 
capability to detect nonself data. This novel method has the advantage of statistical ... 
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The paper presents an approach based on principles of immune systems to the anomaly 
detection problem. Flexibility and efficiency of the anomaly detection system are achieved 
by building a model of network behavior based on the self-nonself space paradigm. ... 
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In 1998 and again in 1999, the Lincoln Laboratory of MIT conducted a comparative 
evaluation of intrusion detection systems (IDSs) developed under DARPA funding. While 
this evaluation represents a significant and monumental undertaking, there are a 
number ... 
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Many different demands can be made of intrusion detection systems. An important 
requirement is that an intrusion detection system be effective; that is, it should detect a 
substantial percentage of intrusions into the supervised system, ... 
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The rapid proliferation of wireless networks and mobile computing applications has 
changed the landscape of network security. The traditional way of protecting networks 
with firewalls and encryption software is no longer sufficient and effective. We ... 
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We present and empirically analyze a machine-learning approach for detecting intrusions 
on individual computers. Our Winnow-based algorithm continually monitors user and 
system behavior, recording such properties as the number of bytes transferred over ... 
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This article describes variants of two state-based intrusion detection algorithms from 
Michael and Ghosh [2000] and Ghosh et al. [2000], and gives experimental results on 
their performance. The algorithms detect anomalies in execution audit data. One ... 
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Intrusion detection systems (IDSs) are used to detect traces of malicious activities 
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targeted against the network and its resources. Anomaly-based IDSs build models of the 
expected behavior of applications by analyzing events that are generated during ... 
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The massive volume of intrusion detection system (IDS) alarms generated on large 
networks, and the resulting need for labor-intensive security analysis of the text-based 
IDS alarm logs, has recently brought into question the cost-effectiveness of IDSs. ... 
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Ad hoc wireless networks are more vulnerable to malicious attacks than traditional wired 
networks due to the silent nature of these attacks and the inability of the conventional 
intrusion detection systems (IDS) to detect them. These attacks operate ... 
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Despite several years of intensive study, intrusion detection systems still suffer from two 
key deficiencies: Low detection rates and a high rate of false alarms. To counteract these 
drawbacks an interactive detection system based on simple Bayesian ... 
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